I would like to group continuous events that occur in order over time, and have a common name. For example: _time name 2016-09-05 10:15:36.691 A 2016-09-05 10:15:32.519 B 2016-09-05 10:15:22.708 C 2016-09-05 10:10:37.374 C 2016-09-05 10:10:25.848 B 2016-09-05 10:10:08.099 B 2016-09-05 10:10:03.349 B 2016-09-05 10:09:31.304 A 2016-09-05 10:09:16.339 A 2016-09-05 10:09:07.415 A Would yield: _time name count 2016-09-05 10:15:36.691 A 1 2016-09-05 10:15:32.519 B 1 2016-09-05 10:15:22.708 C 2 2016-09-05 10:10:25.848 B 3 2016-09-05 10:09:31.304 A 3 Stats and transaction seem to work over all events in a stream, and I haven't found an obvious was to cluster based on the continuous nature of the data. Thanks in advance ... View more

Hi, I have a multi drop-down menu that is populated from a search. I want to set the value of the drop-down menu as 'X' when the search has populated 'X' as an option (the search should always return this value). So far I can grab the element: mvc.Components.getInstance('input2') However, I can only see the statically assigned values of the object when I grab this via the developer console in the browser. Does anybody know if I can register a handler against this object that listens for change, and if it changes enumerates the options and sets 'X' if found? Hope this makes sense. Thanks, Ollie ... View more

 Hi, I'm writing a dashboard with some panels based off an expanding table rows from the Splunk Dashboard 6.x examples app. Code as follows: require([ ... ){ var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function(args) { this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); this._chartView = new ChartView({ managerid: 'details-search-manager', 'charting.legend.placement': 'none' }); }, canRender: function(rowData) { return true; }, render: function($container, rowData) { var sourcetypeCell = _(rowData.cells).find(function (cell) { return cell.field === 'sourcetype'; }); this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count'}); $container.append(this._chartView.render().el); } }); var tableElement = mvc.Components.getInstance("expand_with_events"); tableElement.getVisualization(function(tableView) { tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); }); This all works very nice. What I really need though is to be able to access my base search for the dashboard I've written from javascript, and run my searchManager using that (with my customised search appended), if at all possible. Hope this makes sense? Any suggestions are appreciated, I'll keep digging through the developer doco in the meantime. Thanks, Ollie ... View more

So far I've tried the built in roles User/Power/Admin, but only Administrator worked. I was wondering if anybody new the exact permission's required to insert data into a single app's KV Store via the REST API? Thanks, Ollie ... View more

I have explicitly defined startwebserver = 0 in an app, C:/Program Files/Splunk/bin>splunk cmd btool web list --debug | grep startwebserver C:/Program Files/Splunk/etc/slave-apps/all_indexers/default/web.conf startwebserver = 0 As you can see, it is prioritized correctly and nothing appears to be overwriting it. However, if I restart the indexers, the web service comes up. Note this is a Windows installation. Anybody got any ideas what might be causing this? Thanks in advance ... View more

Hi there, I have CHARSET = UTF-16LE enforced in props.conf for all universal forwarders. For UniForwarder -> Indexer this all works correctly. However, for UniForwarder -> HeavyForwareder -> Indexer this causes an WARN log entry for each processed event on the heavy forwarder: 12-04-2014 15:27:48.026 +0000 WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE Any ideas what I can do to fix this? It's currently being indexed correctly, but generating 1000's of WARN's a minute. Thanks in advance ... View more

Hi, Recently I had an error "Some search results may be incomplete or duplicated as we try to fix up your cluster" which was due to an indexer being unavailable. However, the splunkd and splunkweb services where both running, so none of our service monitoring tools caught it. I would like to tap into the same internal logs that splunk will be using to create that alert in the web dashbaord, and write my own alert that fires us an email when this happens. Does anybody know what internal logs are of interest to monitor the state of an indexer? Thanks in advance ... View more